Chrome Users Allegedly Spied On by Google-Featured Free VPN Extension That Takes ‘Snapshots’ of Website Visits: Report
A Google-featured VPN extension is reportedly carrying out suspicious activities that may compromise the security and privacy of its users.
In a new blog post, the cybersecurity firm Koi Security says that the Chrome extension FreeVPN.One has been silently accessing and capturing screenshots of the pages that users visit.
Says the firm,
“Seconds after any page loads, a background trigger grabs a screenshot and sends it to aitd[.]one/brange.php, bundled with the page URL, tab ID, and a unique user identifier. No user action, no UI hint, the screenshots are taken in the background without you ever knowing.”
Koi Security says the extension behaved like a basic VPN tool for years, but something changed following several updates that the developer rolled out this year. The updates included an “AI Threat Detection” that the firm says enabled broader access to websites.
“On May 31, 2025, the domain aitd.one was registered. A month later, v3.1.3 shipped, and the spying went live.
- Silent screenshots on every site
- Collection began, tracking your location and harvesting your device details
- Data exfiltration commenced, sending everything to the new aitd.one servers.”
Koi Security says the VPN service’s behavior poses risks to users, and its screenshots can sweep “passwords, banking details, personal messages, and any sensitive data rendered on your screen.”
“These images are then uploaded to a third-party server separate from the VPN provider, an exfiltration path entirely opposed with what a privacy tool should do.”
Read the full Koi Security report here .
Generated Image: Midjourney
Disclaimer: The content of this article solely reflects the author's opinion and does not represent the platform in any capacity. This article is not intended to serve as a reference for making investment decisions.
You may also like
New spot margin trading pair — HOLO/USDT!
FUN drops by 32.34% within 24 hours as it faces a steep short-term downturn
- FUN plunged 32.34% in 24 hours to $0.008938, marking a 541.8% monthly loss amid prolonged bearish trends. - Technical breakdowns, elevated selling pressure, and forced liquidations highlight deteriorating market sentiment and risk-off behavior. - Analysts identify key support below $0.0080 as critical, with bearish momentum confirmed by RSI (<30) and MACD indicators. - A trend-following backtest strategy proposes short positions based on technical signals to capitalize on extended downward trajectories.

OPEN has dropped by 189.51% within 24 hours during a significant market pullback
- OPEN's price plummeted 189.51% in 24 hours to $0.8907, marking its largest intraday decline in history. - The token fell 3793.63% over 7 days, matching identical monthly and yearly declines, signaling severe bearish momentum. - Technical analysts cite broken support levels and lack of bullish catalysts as key drivers of the sustained sell-off. - Absence of stabilizing volume or reversal patterns leaves the market vulnerable to further downward pressure.

New spot margin trading pair — LINEA/USDT!
Trending news
MoreCrypto prices
More








